Nefilim and Hive ransomware affiliate gets 70 months in prison
A Ukrainian national was sentenced to 70 months in prison for his role in ransomware attacks targeting hospitals, government entities, and high-revenue businesses worldwide between 2018 and 2021.
Excerpt from the primary source: BleepingComputer
Who is affected
Small businesses · Critical infrastructure
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
Nefilim, Hive ransomware operator given five-year-plus sentence after guilty plea
Ukrainian national Artem Stryzhak, 36, had pleaded guilty last year to charges related to participating in at least two well-known ransomware groups.
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Rapid7’s Q3 analysis finds high-severity flaws exploited within three days on average, while AI appeared in just 8% of tracked incidents.
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
The Cybersecurity and Infrastructure Security Agency (CISA) says the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024.
#StopRansomware: SafePay Ransomware
Advisory at a Glance Title #StopRansomware: SafePay Ransomware Original Publication October 20, 2026 Executive Summary This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by…
CISA lists this as exploited in the wild and known to be used in ransomware campaigns. Unpatched SonicWall firewalls & SMA and Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) systems are exposed to active attacks now.
Treat this as an emergency.